https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247819#M73938 <P>Good to know. Thanks.</P> Fri, 13 May 2016 13:40:29 GMT sundareshr 2016-05-13T13:40:29Z https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247815#M73934 <P>Hello, </P> <P>I've been reading a lot of posts here, but I seem to be missing something because I'm not understanding.</P> <P>Search Rule</P> <PRE><CODE>ACCEPT | lookup dnslookup clientip AS src_ip OUTPUT clienthost as Hostname </CODE></PRE> <P>Output</P> <PRE><CODE>5/13/16 2:37:03.000 PM 2 698177307011 eni-8eceafeb 54.187.193.193 172.31.8.32 443 50656 6 8 3684 1463114223 1463114226 ACCEPT OK dest_ip = 172.31.8.32 host = ip-10-20-6-215 src_ip = 54.187.193.193 5/13/16 </CODE></PRE> <P>I'm not getting any new field called "hostname" and it certainly isn't populating with a resolved DNS.</P> <P>What am I missing? I want to see all the resolved IP's hostnames in a field populated.</P> <P>Any assistance appreciated. </P> Fri, 13 May 2016 04:50:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247815#M73934 chrisprangnell 2016-05-13T04:50:21Z https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247816#M73935 <P>Please go to settings -&gt; lookups -&gt; lookup definitions and see if you have a lookup named "dnslookup" </P> <P>If it is there, make sure it is enabled and shared with the desired permissions.</P> <P>Then, make sure the splunk server that is executing the lookup has proper DNS servers setup.</P> <P>Finally check "index=_internal log_level=warn* OR log_level=err*" and "index=_internal external_lookup.py" for any errors, and let us know what you find.</P> Tue, 29 Sep 2020 09:42:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247816#M73935 jkat54 2020-09-29T09:42:14Z https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247817#M73936 <P>In addition, insure dnslookup definition is mapped to the right .csv file. Also remember the field names (in &amp; out) are case-sensitive. Its probably just a typo, but you have Hostname with upper &amp; lower "h" in your question.</P> Fri, 13 May 2016 11:27:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247817#M73936 sundareshr 2016-05-13T11:27:08Z https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247818#M73937 <P>@sundareshr, the dnslookup lookup is an external lookup that uses a python script. If the op doesnt have it, then it's probably due to their version of splunk. It was news to me as well, but I do have this lookup in splunk 6.4 on my local machine.</P> Fri, 13 May 2016 11:55:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247818#M73937 jkat54 2016-05-13T11:55:57Z https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247819#M73938 <P>Good to know. Thanks.</P> Fri, 13 May 2016 13:40:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-resolve-IP-to-external-hostname-and-list-it-in-a-field/m-p/247819#M73938 sundareshr 2016-05-13T13:40:29Z